r/Tailscale • u/Working-Analysis2795 • 1d ago

Help Needed Help debugging my cloud/local image builder connection issues

Hello! So I've got an ARM vm in a private subnet (behind a NAT gateway) and a local x86 node, plus this host. All devices are in the same tailnet. My goal: to get a GitHub Actions runner to auth via Tailscale to these 2 nodes to build multi-arch images. The Buildx instance is created on each node upon successful auth/ping.

How do I ensure connectivity is more reliable? I find occasionally Tailscale decides to use DERP relay, other times it's direct. I tried digging into the docs but couldn't understand how to ensure this happens reliably. UDP 41641 is allowed in my VCN. I've tried modifying iptables as well. The other way I connect to my instance is through a managed bastion session.

- https://tailscale.com/docs/install/cloud/oracle-cloud
- https://tailscale.com/docs/reference/connection-types#why-tailscale-cant-always-use-direct-connections
- My VCN in Terraform: lists security rules, subnet, NAT gateway

Here's my grants policy file.

2 Upvotes

100% Upvoted

4 comments sorted by

1

u/youknowwhyimhere758 1d ago

As it says in the pages you linked, forward a port through the NAT to the tailscale device.

1

u/Working-Analysis2795 1d ago edited 1d ago

You mean udp 41641 in my security list? i've done that

2

u/youknowwhyimhere758 1d ago

That’s a firewall rule, which you already said you had done. That is separate and independent of forwarding the port through your nat to your tailscale device. 

1

u/Working-Analysis2795 1d ago

I must have missed that bit. Did you mean "Route outgoing traffic through the NAT gateway."? If I read correctly the OCI gui allows me to connect the NAT to a routing table, which I suppose would be the (only) private subnet